Full Report
Sometimes hackers can be overly confident in their malware. Take a journey with us through a malware sample that contains no obfuscation whatsoever.
Analysis Summary
# Tool/Technique: Valak
## Overview
Valak is a sophisticated information stealer and malware loader that historically targeted organizations in the US and Germany. It is primarily known for its modular design and its ability to utilize JScript and Windows Registry manipulation to maintain persistence and execute payloads. This specific variant analyzed is notable for its initial "boldness," featuring a complete lack of obfuscation for its C2 infrastructure within the primary script.
## Technical Details
- **Type:** Malware Family (Loader / InfoStealer)
- **Platform:** Windows
- **Capabilities:** Credential theft, reconnaissance, modular plugin downloading, and payload delivery (often serving as a precursor to ransomware).
- **First Seen:** Early 2019 (This specific report: April 2022)
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript/JScript
- **TA0003 - Persistence**
- T1112 - Modify Registry
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Note: While the analysis focuses on the *lack* of it, the malware uses `eval` to execute hidden code)
- T1564.001 - Hidden Files and Directories
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
- T1568.002 - Domain Generation Algorithms (DGA) / Rotational C2
## Functionality
### Core Capabilities
- **JScript Execution:** Utilizes Microsoft’s JScript dialect to interact with Windows internals via `ActiveXObject`.
- **Registry-Based Payload Storage:** Reads malicious code directly from Windows Registry keys (e.g., `HKCU\Software\ApplicationContainer\Appsw64\WebLib32`) to avoid file-based detection.
- **Dynamic Code Execution:** Uses the `eval()` function to execute strings retrieved from the registry as functional code.
- **C2 Communication:** Builds dynamic endpoints using nonces (random 12-character strings) and custom rotation ciphers to obfuscate traffic.
### Advanced Features
- **Anti-Analysis/Blending:** Includes legitimate domains (like Google's `redirector.gvt1.com`) in its C2 list to hide malicious traffic among standard network noise.
- **Modular Framework:** Designed to call additional "DataTools" and plugins depending on the environment and the attacker's objectives.
## Indicators of Compromise
- **File Names:** `explorer.js`
- **Registry Keys:** `HKEY_CURRENT_USER\Software\ApplicationContainer\Appsw64\WebLib32`
- **Network Indicators:**
- `http[:]//onecs-live[.]azureedge[.]net`
- `http[:]//ipm-provider[.]ff[.]avast[.]com`
- `http[:]//tauhutxiga[.]com`
- `http[:]//monsuperentrepreneur[.]com`
- `http[:]//tangocation[.]com`
- `http[:]//e4a24fb0e[.]com`
- `http[:]//f78efaf43b[.]com`
- **Behavioral Indicators:** `wscript.exe` or `cscript.exe` executing scripts that perform registry reads from `Appsw64` paths.
## Associated Threat Actors
- Historically linked to various cybercriminal groups; often used as a stage-one loader for secondary payloads like **IcedID** or ransomware.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific `explorer.js` filename and the hardcoded C2 strings.
- **Behavioral detection:** Flagging `wscript.exe` instances that call `eval()` on data pulled from non-standard Registry locations.
- **Registry Monitoring:** Auditing the `HKCU\Software\ApplicationContainer\` path for large blobs of encoded/encrypted text.
## Mitigation Strategies
- **Disable WSH:** Disable Windows Script Host (WSH) if not required for business operations to prevent JScript execution.
- **File Association:** Reassociate `.js` and `.jse` files to open with Notepad rather than the script engine.
- **Endpoint Protection:** Use EDR solutions to monitor for suspicious parent-child process relationships (e.g., an Office application spawning `wscript.exe`).
## Related Tools/Techniques
- **Gootloader:** Often uses similar JScript-based delivery mechanisms and registry persistence.
- **TrickBot:** Frequently associated with similar obfuscation and delivery patterns.
- **Bring Your Own Command & Control (BYOC2):** The technique of embedding cleartext infrastructure within a tool, relying on the speed of the attack or the noise of the network to evade notice.